Arnas Donauskas 44183bc750 fix(whatsapp): guard the template image-header fetch against SSRF ... `ensureImageHeaderHandle` fetched the caller-supplied `header_media_url` server-side with no validation, so a template submit — an action any authenticated member can perform — could reach loopback, RFC1918 and cloud-metadata addresses, with the response status and content-type echoed back through the thrown error. Wire in the project's existing `isDeliverableUrl` guard, which the two other outbound-fetch call sites (webhook delivery, automation `send_webhook`) already use, and reuse their `redirect: 'manual'` + timeout so a public URL can't 3xx-bounce to an internal one. The rejection reuses the unreachable-host message verbatim so the failure doesn't distinguish "blocked" from "down". Addresses GHSA-6fr5-pxw7-r3xw. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>		2026-07-28 13:07:09 +03:00
..
broadcast-core.test.ts	feat(api): public REST API v1 — messages, contacts, conversations, broadcasts (#245)	2026-07-01 14:10:19 +03:00
broadcast-core.ts	feat(api): public REST API v1 — messages, contacts, conversations, broadcasts (#245)	2026-07-01 14:10:19 +03:00
encryption.test.ts	test: foundational Vitest suite for security + critical pure logic	2026-05-18 16:06:02 +03:00
encryption.ts	security: switch WhatsApp token encryption from AES-CBC to AES-GCM	2026-04-20 20:25:48 +03:00
interactive.test.ts	feat: WhatsApp interactive messages (reply buttons + lists)	2026-07-08 19:03:15 +03:00
interactive.ts	feat: WhatsApp interactive messages (reply buttons + lists)	2026-07-08 19:03:15 +03:00
meta-api.media.test.ts	feat(inbox): send photo, video, document & voice in chat (#213)	2026-06-18 10:07:16 +03:00
meta-api.resumable.test.ts	feat(templates): upload image for template headers; fix image-URL submit (#230)	2026-06-18 14:00:54 +03:00
meta-api.test.ts	feat(flows): foundation for interactive WhatsApp messages (PR 1/4)	2026-05-22 13:12:27 +03:00
meta-api.ts	feat: WhatsApp interactive messages (reply buttons + lists)	2026-07-08 19:03:15 +03:00
phone-utils.test.ts	test: foundational Vitest suite for security + critical pure logic	2026-05-18 16:06:02 +03:00
phone-utils.ts	feat: auto-retry with phone variants on Meta "not in allowed list"	2026-04-16 21:34:53 +03:00
registration.test.ts	fix(whatsapp): register phone numbers on Meta + verify subscription state	2026-05-29 18:12:38 +02:00
resolve-conversation.test.ts	fix: stop inbound chats fragmenting into duplicate conversations (#363)	2026-07-10 12:27:46 +03:00
resolve-conversation.ts	fix: stop inbound chats fragmenting into duplicate conversations (#363)	2026-07-10 12:27:46 +03:00
send-message.test.ts	feat: WhatsApp interactive messages (reply buttons + lists)	2026-07-08 19:03:15 +03:00
send-message.ts	feat: WhatsApp interactive messages (reply buttons + lists)	2026-07-08 19:03:15 +03:00
template-components.test.ts	feat(templates): submit-to-Meta endpoint + component-based form builder	2026-05-29 15:34:58 +02:00
template-components.ts	feat(templates): submit-to-Meta endpoint + component-based form builder	2026-05-29 15:34:58 +02:00
template-header-handle.test.ts	fix(whatsapp): guard the template image-header fetch against SSRF	2026-07-28 13:07:09 +03:00
template-header-handle.ts	fix(whatsapp): guard the template image-header fetch against SSRF	2026-07-28 13:07:09 +03:00
template-lifecycle.test.ts	feat(templates): edit / resubmit / delete lifecycle endpoints	2026-05-29 15:57:24 +02:00
template-row-guard.ts	chore(templates): polish pass from senior backend / FE / UX review	2026-05-29 17:50:11 +02:00
template-send-builder.test.ts	feat(templates): upload image for template headers; fix image-URL submit (#230)	2026-06-18 14:00:54 +03:00
template-send-builder.ts	feat(templates): upload image for template headers; fix image-URL submit (#230)	2026-06-18 14:00:54 +03:00
template-status-normalize.test.ts	feat(templates): submit-to-Meta endpoint + component-based form builder	2026-05-29 15:34:58 +02:00
template-status-normalize.ts	feat(templates): submit-to-Meta endpoint + component-based form builder	2026-05-29 15:34:58 +02:00
template-validators.test.ts	feat(templates): submit-to-Meta endpoint + component-based form builder	2026-05-29 15:34:58 +02:00
template-validators.ts	feat(templates): submit-to-Meta endpoint + component-based form builder	2026-05-29 15:34:58 +02:00
template-webhook.test.ts	feat(templates): webhook handler for real-time status / quality updates	2026-05-29 16:20:50 +02:00
template-webhook.ts	feat(templates): webhook handler for real-time status / quality updates	2026-05-29 16:20:50 +02:00
webhook-signature.test.ts	test: foundational Vitest suite for security + critical pure logic	2026-05-18 16:06:02 +03:00
webhook-signature.ts	fix(webhook): require META_APP_SECRET, fail closed	2026-04-20 18:54:52 +03:00